--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2014-4334
2014-11-30 18:17:16
--------------------------------------------------------------------------------
Name : fail2ban
Product : Fedora EPEL 7
Version : 0.9.1
Release : 2.el7
URL :
http://fail2ban.sourceforge.net/
Summary : Daemon to ban hosts that cause multiple authentication errors
Description :
Fail2Ban scans log files and bans IP addresses that makes too many password
failures. It updates firewall rules to reject the IP address. These rules can
be defined by the user. Fail2Ban can read multiple log files such as sshd or
Apache web server ones.
Fail2Ban is able to reduce the rate of incorrect authentications attempts
however it cannot eliminate the risk that weak authentication presents.
Configure services to use only two factor or public/private authentication
mechanisms if you really want to protect services.
This is a meta-package that will install the default configuration. Other
sub-packages are available to install support for other actions and
configurations.
--------------------------------------------------------------------------------
Update Information:
- Fix php-url-fopen logpath (bug #1169026)
- Update to 0.9.1:
Refactoring (IMPORTANT -- Please review your setup and configuration):
iptables-common.conf replaced iptables-blocktype.conf (iptables-blocktype.local should
still be read) and now also provides defaults for the chain, port, protocol and name
tags
Fixes:
start of file2ban aborted (on slow hosts, systemd considers the server has been timed
out and kills him), see gh-824
UTF-8 fixes in pure-ftp thanks to Johannes Weberhofer. Closes gh-806.
systemd backend error on bad utf-8 in python3
badips.py action error when logging HTTP error raised with badips request
fail2ban-regex failed to work in python3 due to space/tab mix
recidive regex samples incorrect log level
journalmatch for recidive incorrect PRIORITY
loglevel couldn't be changed in fail2ban.conf
Handle case when no sqlite library is available for persistent database
Only reban once per IP from database on fail2ban restart
Nginx filter to support missing server_name. Closes gh-676
fail2ban-regex assertion error caused by miscount missed lines with multiline regex
Fix actions failing to execute for Python 3.4.0. Workaround for
http://bugs.python.org/issue21207
Database now returns persistent bans on restart (bantime < 0)
Recursive action tags now fully processed. Fixes issue with bsd-ipfw action
Fixed TypeError with "ipfailures" and "ipjailfailures" action
tags. Thanks Serg G. Brester
Correct times for non-timezone date times formats during DST
Pass a copy of, not original, aInfo into actions to avoid side-effects
Per-distribution paths to the exim's main log
Ignored IPs are no longer banned when being restored from persistent database
Manually unbanned IPs are now removed from persistent database, such they wont be
banned again when Fail2Ban is restarted
Pass "bantime" parameter to the actions in default jail's action
definition(s)
filters.d/sieve.conf - fixed typo in _daemon. Thanks Jisoo Park
cyrus-imap -- also catch also failed logins via secured (imaps/pop3s). Regression was
introduced while strengthening failregex in 0.8.11 (bd175f) Debian bug #755173
postfix-sasl - added journalmatch. Thanks Luc Maisonobe
postfix* - match with a new daemon string (postfix/submission/smtpd). Closes gh-804 .
Thanks Paul Traina
apache - added filter for AH01630 client denied by server configuration.
New features:
New filters:
monit Thanks Jason H Martin
directadmin Thanks niorg
apache-shellshock Thanks Eugene Hopkinson (SlowRiot)
New actions:
symbiosis-blacklist-allports for Bytemark symbiosis firewall
fail2ban-client can fetch the running server version
Added Cloudflare API action
Enhancements
Start performance of fail2ban-client (and tests) increased, start time and cpu usage
rapidly reduced. Introduced a shared storage logic, to bypass reading lots of config files
(see gh-824). Thanks to Joost Molenaar for good catch (reported gh-820).
Fail2ban-regex - add print-all-matched option. Closes gh-652
Suppress fail2ban-client warnings for non-critical config options
Match non "Bye Bye" disconnect messages for sshd locked account regex
courier-smtp filter:
match lines with user names
match lines containing "535 Authentication failed" attempts
Add <chain> tag to iptables-ipsets
Realign fail2ban log output with white space to improve readability. Does not affect
SYSLOG output
Log unhandled exceptions
cyrus-imap: catch "user not found" attempts
Add support for Portsentry
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update fail2ban' at the command line.
For more information, refer to "Managing Software with yum",
available at
http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------